GRE over IPsec is the correct secure tunneling choice when multicast traffic must cross a public network.
Native IPsec protects unicast IP traffic, but it does not inherently carry multicast routing protocols or multicast application flows in the same way that GRE can. GRE creates a logical point-to-point tunnel that can encapsulate multicast, broadcast, and non-IP payloads; IPsec then encrypts the GRE packet for confidentiality and integrity across the untrusted transport. Cisco designs commonly use this combination when dynamic routing protocols, multicast applications, or other non-unicast traffic must be transported securely between sites. GRE by itself supports multicast, but it does not provide encryption, so it fails the secure tunneling requirement. PPTP is obsolete and not appropriate for modern enterprise design. Plain IPsec is secure, but it is not the complete answer when multicast support is explicitly required. Therefore, the design should use GRE over IPsec: GRE supplies the multicast-capable overlay, and IPsec supplies the cryptographic protection across the public network.